CVE-2026-72434

A flaw was found in the Linux kernel's netfilter ipset component. When destroying a set, the garbage collection (gc) mechanism may not be properly stopped due to an unconditional call to queue_delayed_work() while cancel_delayed_work_sync() is called. This improper shutdown can lead to resource exhaustion, potentially resulting in a Denial of Service (DoS) condition.

A flaw was found in the Linux kernel's netfilter ipset subsystem, rated by Red Hat Product Security as having Moderate impact. When an ipset that uses timeout-based garbage collection is destroyed, the garbage collection (gc) delayed work is not reliably stopped: cancel_delayed_work_sync() is called while the gc path can still unconditionally call queue_delayed_work() and re-queue itself, so a later gc run may operate on a set that has already been freed. A local attacker with the privileges required to manage ipsets (for example CAP_NET_ADMIN, which may be delegated to a container root or a network management service rather than full host root) could trigger this race by destroying a set, causing an RCU stall, kernel panic, or other system instability, resulting in a denial of service. Red Hat has assessed this flaw as having availability-only impact (CVSS 3.1 base score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); this is lower than the upstream CVEORG score of 7.8 because the upstream score assumes high confidentiality and integrity impact, which Red Hat's analysis does not support for this race-condition-driven gc shutdown issue.

The kernel and kernel-rt packages in Red Hat Enterprise Linux 8 (rhel-8.10.z), Red Hat Enterprise Linux 9 (rhel-9.2.0.z through rhel-9.9), and Red Hat Enterprise Linux 10 (rhel-10.0.z through rhel-10.3) are affected, and the fix is currently deferred to a future update for these streams. Exploitation requires privileged local access and a narrow race window during set destruction, and the consequence is limited to local denial of service, so the residual risk of deferring the fix is considered low. Red Hat Enterprise Linux 6 ELS is out of support scope for this flaw. Red Hat Enterprise Linux 7 ELS, the rhel-8.4.0.z, rhel-8.6.0.z, and rhel-8.8.0.z update streams, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those builds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.